Your phone number has become a kind of universal key. It's used to receive bank codes, recover your email and sign in to chats and social media. That's why there is a fraud that targets not the phone but the number: the SIM swap.
How it works
The mechanism is simple in essence. The fraudster persuades your mobile operator to move your number onto a new SIM card in their possession. They may do it by posing as you in a shop with a forged document, by contacting customer support with personal data gathered beforehand or, in the worst cases, with the help of someone inside the sales chain. There is also a variant based on porting the number to another operator.
From that moment:
- your SIM stops working;
- all calls and texts meant for you reach the fraudster;
- verification codes sent by SMS end up in their hands.
If the fraudster already knows your online banking or email password, perhaps obtained through phishing, the number is the last piece they were missing.
The warning signs
The most obvious sign is that your phone suddenly loses network service for no apparent reason: no calls, no texts, "no service" or "emergency calls only", while the people around you have signal. Sometimes you first receive a text from the operator about a SIM change or port request you didn't make.
Other signs:
- sign-in or password change notifications from services you're not using;
- being unable to access accounts that worked until shortly before;
- "verification" calls from self-styled operators in the preceding days.
What to do if it happens
Act immediately, from another phone or a computer:
- Call your operator on the official support number, explain that your number appears to have been transferred without authorisation and ask for an immediate block.
- Contact your bank to block transactions and online banking access.
- Change your main email password and, where possible, turn off SMS-based recovery.
- Check the other accounts that use the number for recovery.
- Report it to the police, keeping the operator's texts and the times you lost service.
How to reduce the risk
Protect the data needed to impersonate you
The fraudster needs to know who you are: name, date of birth, address, tax or ID numbers, sometimes your document number. Avoid publishing these details and be wary of anyone asking for them on the phone "for a check". Don't send photos of your documents to strangers, not even for a rental or an online sale, without verifying who they are.
Ask your operator about available protections
Some operators offer security codes for account changes or stronger procedures for SIM replacement. Ask yours what they provide and turn it on if you can.
Rely less on SMS
This is the most effective defence. Wherever the service allows it:
- replace SMS codes with an authenticator app, a passkey or a physical key;
- for banking, use the official app with approval by notification or biometrics, which is tied to the device rather than the number;
- for your main email, set a second protected email address and recovery codes as recovery methods, in addition to or instead of the number.
That way, even if your number were stolen, the fraudster would receive texts that no longer get them in.
Consider a number just for recovery
Some people use a second number, never published or shared, solely for verifying their most important accounts. It isn't necessary for everyone, but for more exposed people it can be a useful choice.
SIM swap and SIM PIN are not the same thing
The SIM PIN protects against someone who physically steals your phone and tries to use your card. In a SIM swap the fraudster never touches your SIM: they get a new one from the operator. The PIN is still useful, but it isn't enough against this fraud.
A realistic example
A professional receives a phishing text that looks like it's from his bank and enters his credentials. A few days later, in the early afternoon, his phone loses signal. He assumes it's a fault and waits until evening. Meanwhile the fraudster, with a duplicate SIM, receives the codes and makes transfers. Had he called the operator and the bank straight away, or had the bank required approval through an app tied to the device, the transactions would have been much harder.
In short
- A SIM swap moves your number onto the fraudster's SIM, so they receive your texts and calls.
- A sudden, unexplained loss of service should be treated as an emergency.
- Call your operator and your bank immediately from another device.
- Protect the personal data needed to impersonate you.
- Replace SMS codes with authenticator apps, passkeys or physical keys.